Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

BonesSB writes "I'm a student at a university in Massachusetts, where I have a federal work-study position. Yesterday, I got an email from the office that is responsible for student run organizations (one of which I work for) saying that I need to go to their office and have my fingerprints taken for the purposes of clocking in and out of work. This raises huge privacy concerns for me, as it should for everybody else. I am in the process of contacting the local newspaper, getting the word out to students everywhere, and talking directly to the office regarding this. I got an email back with two very contradictory sentences: 'There will be no image of your fingerprints anywhere. No one will have access to your fingerprints. The machine is storing your prints as a means of identifying who you are when you touch it.' Does anybody else attend a school that requires something similar? This is an obvious slippery slope, and something I am not taking lightly. What else should I do?"

Hey look, what's that behind you? It's much more interesting than any contradictions you might see in the following. There will be no image of your fingerprints anywhere. No one will have access to your fingerprints. The machine is storing your prints as a means of identifying who you are when you touch it. If you're still reading this, damn.

This leads to the principle flaw of biometrics: If someone manages to reproduce the key (synthetic fingerprint for example), there is no way to issue a different key to the owner of the original. Anywhere you authenticate with a fingerprint, the people who control the system can gather all information which is needed to create a fake fingerprint, plus there are countless other ways to get a person's fingerprint, and you still only have that one set of fingerprints that you can't change. What are you going to do then?

This isn't a flaw of biometrics so much as it's a flaw of any dongle-based, single-layer security system.

For example, you have the same problem with a door with the same key issued to 1000 people -- yes it technically can be changed, but it's quite expensive, so in practice it's never done. That leads to people who should no longer have access still having access, and the ability to easily copy the key and use the copy without detection.

The solution is trivial. If you combined a password with a fingerprint there would be a secret bit of information that's easy to change AND a physical bit of security apparatus that's harder to reproduce/copy than a password. This same solution also solves the key problem above. And it's the same solution already used in all sorts of applications where security is actually important.

It's not in use for this timeclock system because the problem they're trying to solve is not a high-security application. They're going from the honor system for clocking in to a single-layer physical-dongle security system, likely in an attempt to raise the barriers for clocking in a co-worker. If they were relying on this system to allow you to make changes to your direct deposit account it would be a problem, but for the stated application I don't see why it's a concern.

Now, you could be concerned about them having your fingerprints on file -- I understand the desire to keep people from collecting information about you. But honestly, unless you wear gloves all day long, they could already have your fingerprints if they wanted them; fingerprints are not secret information in the first place.

Both major algorithms need to be able to compare the data from an authoritative database against the test sample.

The reason for this is no two scanners, in fact even the same scanner will not produce identical results for the same fingerprints. There will always be "fuzziness" to the data that the algorithm must interpret.

Hashing would work if the scanners were taking absolute, binary measurements without error. But they are not, not a single biometrics unit has or can have that sort of precision. If you capture your fingerprint parameters with the same device, with the same process, two or three times in a row, you'll see significant changes in the parameters from one time to the next. While the detection algorithms are designed to cope with such scanning errors, hashing would make relative comparisons fail 100% of the time.
And there lies the problem with biometrics: once you use them once (or even before you do), your "parameters" are no longer a secret under your control. If you give your fingerpring parameters to your bank, your school and your employer, each of them can in theory authenticate as you to the others.
That's why I always say: biometrics are technically useless as an authentication mechanism. They can be used for identification (replacing your username) but not for validation (your password) because they are NOT a secret, they CAN'T be revoked, you don't have the option to use different ones for different organizations and they are easy to fake. Of these issues, only the last one can be improved with better technology, the rest are intrinsic to the concept.

I've installed systems that work like this. They store afew statistical points of your fingerprint. If someone actually got those points that they stored, they still couldn't make a complete fingerprint.

This type of system is usually implemented due to former employees punching in for each other. This is a way that makes that more difficult.

This type of system is usually implemented due to former employees punching in for each other. This is a way that makes that more difficult.

Only if you work for a security conscious facility who is willing to deal with the hassles of running such a system. Both places I've been at that used it for just timeclock purposes either turned the discrimination down so far that at least one other person could fake for them, or gave up on the high false negative rate and switched to "type in something you wouldn't

I don't want the government tapping into my phone, spying on my Internet traffic, or searching through my house without just cause.. but we're talking finger prints here.

And while I do agree.. saying the only alternative is welfare was a little extreme.. you are definitely limiting yourself by refusing to allow any intrusions into your precious privacy.

I suppose some people will accept a lot of money to surrender their freedoms.

This is completely true.. and I think in a lot of cases.. people are better off for it. Everything is a balancing act.. certain jobs (especially government) require a fair degree of background checking.. this is of course an invasion into your privacy.. but you are compensated for it (both financially and in terms of getting to work on some really cool stuff).

It's not about completely selling out your privacy.. but it's not about living the life of a paranoid delusional who thinks the world is out to get them either. It's about finding a balance you're comfortable with.

As someone who has "given up" a lot of privacy in exchange for a very enjoyable career.. I've felt no ill effects from it. What exactly do the tin foil types of the world think the government / Illuminati / whatever.. are doing with this information.. and specifically.. how do they think it's going to realistically effect their lives in an actual concrete way (vice some paranoid "when the commies come back" throb).

And... just what "freedoms" are being surrendered? The contents of our lives are sequestered already in many dozens of places. Our complete physiology in doctor's files. Tell me the government is hands-off with those? Pictures on our driver's license - how is that different from a "picture" of your fingerprint? Nowadays even that is digital and contains a lot more information about you than your fingerprint. Surely you have a driver's license, doncha? So, what freedoms have you surrendered? You get to do wh

I am on federal work study right now and I have not had to submit my fingerprints for anything. You have a few options.

Accept that this is the way they track work study hours.

If you can afford it and the privacy concerns are too compelling, decline the work and let them know why in a formal letter. It may go directly to the waste bin but at least you made your reasons known.

Lastly, you can try to change the policy. Contact your student senate for some backing as they're the most likely to listen, although not the most likely to have power to change it. A couple of suggestions: Switch from bio-informatics scanning methods to plain old bar code badges, RFID chips or paper timecards.

My school does work study timecards on paper. It's probably the most likely to be abused, but it is convenient for everyone. I'd be more than happy to use an RFID token or bar code badge for clocking in and out. Wouldn't work very well for my specific job, considering I work from home, but in theory I would accept either.

Your ability to change the policy by force is pretty limited. Employment rights(especially regarding privacy) vary by state when it comes to work study. You could try to contact your local department of labor but it's unlikely they will give you anything other than a headache.

I've used biometric scanners like this in the past. Whatever it stores to recognize your fingerprint never leaves the machine. I don't know if that's what's going on here, but it seems perfectly reasonable.

Apparently what it is storing is a statistical summary of the biometric information (if that's not redundant). It doesn't store the fingerprints themselves anymore than an operating system will store your password. With the password, whatever you type in has to have a hash which matches the hash associated with your account. With the scanner, the summary generated each time you plop your hand on the scanner has to match (to a significant degree) the summary on file.

But, yes, if someone finds your fingerprints somewhere else, and they have access to this data, they can be reasonably certain it is you.

Yes, that is right. This is due to Brazilian Constitution, which says that all diplomacy must be reciprocal. E.g., for every country which demands a visa from Brazilian people, Brazil demands a visa for their people to get in Brazil. If the government, the Federal Police or the airport authority decides to do any different, they will get sued.

My point being that we (US) treat others like crap for NO reason, we get shafted back. I'm currently getting my 4th work visa in my 3rd country, and I really do think it ends up being a detriment to come from the US.

I agree.. if you don't like it.. don't do it. No one is forcing you to. Others may not have the same concerns and would be more than happy to do that job, so I'm sure it won't bother them too much.

I used to work at a job that required using an id card to clock in and out. If you left it at home it was a huge hassle to get a temporary id card. Forget it too many times and they started to take disciplinary action. I'd rather use my fingerprint to 'clock in' than try and remember to bring my id card every day when the only function of that card was to clock in and out.

I agree.. if you don't like it.. don't do it. No one is forcing you to. Others may not have the same concerns and would be more than happy to do that job, so I'm sure it won't bother them too much.

Those others and their indifference is part of the problem. If this university is doing this, you can bet that others have considered it. If this is successful and does not receive much opposition, others will follow suit. The result is that the people who do care about privacy are going to have fewer ways to protect it. So no one is forcing you to support this right now but when every such institution adopts these requirements, that will change. Of course by that time there'll be little or no hope of doing anything about it because it will be entrenched.

It's similar in some ways to the relative uniformity of cellphone service plans in the USA despite the multiple competing companies that offer it. A few such companies established pricing and service plans and were successful, so others adopted similar business practices. The result is that there's little actual innovation in the industry. None of the cellphone companies has any incentive to rethink their pricing, so I as a customer cannot vote with my wallet if I want, for example, text messaging prices that realistically reflect the actual cost of delivering SMS.

I'm sure there is a whole litany of reasons why an institution wants biometric identification. I'm sure that some of those justifications are reasonable enough. I just don't care, to be honest with you. I don't want to live in a surveillance society. If that means a few more unauthorized users gain access, or if that means a few more criminals avoid detection, I'm fine with that and more than willing to take my chances. Only cowardice would make me feel differently. It is obvious to me that a surveillance society is like a totalitarian state; it is created by means of baby steps. Each baby step down that path looks harmless enough at the time and plenty of useful idiots will sing the mantra of "I've got nothing to hide, so I'll surrender my privacy to anyone who asks." Stop this early when it seems minor and benevolent and you avoid the tremendous problems that become inevitable otherwise.

I used to work at a job that required using an id card to clock in and out. If you left it at home it was a huge hassle to get a temporary id card. Forget it too many times and they started to take disciplinary action. I'd rather use my fingerprint to 'clock in' than try and remember to bring my id card every day when the only function of that card was to clock in and out.

I'm sorry but I believe in fixing problems at their source. This is simple forgetfulness that a little self-discipline can easily solve. The privacy of every member of society that is never coming back once lost is far more important than the very minor inconvenience to you of learning to bring your ID card to work. To say otherwise is supreme selfishness and amounts to forcing your beliefs about privacy on everyone else. Those who like privacy appreciate that about as much as you'd appreciate being forced to practice a religion you don't believe in. I don't think you really are this selfish; I just think you're not considering the full implications of your position.

Privacy is a good default; anyone who doesn't want it can always become an exhibitionist with their personal information if that's what they want to do. I won't try to find ways to stop them since it's their choice and, unlike this slippery slope, doesn't affect me in any way either real or potential. Anyone who thinks that this won't grow and expand if it isn't stopped, who believes that the companies producing biometric machines won't seek new markets and new customers, who really thinks that no one would ever want to retain and datamine such detailed information about your habits and whereabouts, is frankly rather naive.

Its a time clock. Many jobs have them along with your address, phone number, date of birth, and social security number. Welcome to the working world. I could just as easily steal your fingerprints from your car door handle or the can you threw in the trash. After this fiasco don't expect the job offers to roll in.

Solutions like this are often used to prevent someone clocking-in for you. I used this type of solution at a sports club which used to go to, where you would enter your member number followed by you finger print. Chances are this is another closed system, so it the finger prints probably won't get much further than the database.

As long as you are assured that your privacy is protected...this is a huge non-issue. Fingerprint scanners are the best (In terms of ease of implementation) way to prevent people from clocking in and out for each other, even though they are obviously easily defeated by anyone sufficiently motivated.

And with an inkjet printer and blank check paper, you can commit bank fraud. How is the fact that you CAN cheat relevant?

At literally every hourly job I have ever held in my life, people "clocking in" to cover for friends has been a huge problem.Its outright theft from the employer, yet people that would never steal physical property, will cheat a time clock without thinking twice.

Yup, exactly correct.
Scanners will store a "hashed" version of your fingerprint based off of an algorithm. It just stores the "fingerprint" as a random string of data.
The more secure versions store the hash on a Smart Card, which you have to authenticate against. The DoD uses this type of system on their ID cards for Contractors, Civilians and Military personnel.
If you're worried about how bad this situation is, you need to watch a specific myth busters episode: http://www.youtube.com/watch?v=LA4Xx5No [youtube.com]

Same as the old one... My wife's workplace has this system. Works terribly but somehow it got past some CxO. Not sure if the privacy issue is a big deal however. You train the system in the system (if it's the same one). The print doesn't go out to the big Gov.

Not saying that they couldn't do that, but you do realize (being an aluminum foil shielded card carrying Slasdotter) that 'they' can get your fingerprints, DNA and bog knows what else without much of a problem these days.

At Disney World, they require finger prints when you enter the park if you want to be able to re-enter or switch to another park (if you have a ticket that allows that). At least the government doesn't directly get them, but who knows what they're doing with them or how long they keep them. (This was several years ago; I don't know if it's changed.)

At Disney World, they require finger prints when you enter the park if you want to be able to re-enter or switch to another park (if you have a ticket that allows that). At least the government doesn't directly get them, but who knows what they're doing with them

Every night after the park closes, they dust every door handle to see who went where, and if anyone attempted to open "Employee Only" doors. Or maybe the park high mucky-mucks are fingerprint fetishists? Or maybe, just maybe, there's nothing sinister about it.

Yes, and I was equally concerned with them using these at Disney World! Thankfully they don't collect fingerprints from kids - maybe they're also concerned with the potential legal issues?

Hint - at least at Disney World you can decline. You simply have to show picture ID. Don't be a sheep - at least ask what your options are, how your privacy will be protected, and what THEIR liability is if there is a breach in that privacy.

And friends, somewhere in Washington enshrined in some little folder, is astudy in black and white of my fingerprints. And the only reason I'msinging you this song now is cause you may know somebody in a similarsituation, or you may be in a similar situation, and if your in asituation like that there's only one thing you can do and that's walk intothe shrink wherever you are,just walk in say "Shrink, You can getanything you want, at Alice's restaurant.".

And I went up there, I said, "Shrink, I want to kill. I mean, I wanna, Iwanna kill. Kill. I wanna, I wanna see, I wanna see blood and gore andguts and veins in my teeth. Eat dead burnt bodies. I mean kill, Kill,KILL, KILL." And I started jumpin up and down yelling, "KILL, KILL," andhe started jumpin up and down with me and we was both jumping up and downyelling, "KILL, KILL." And the sargent came over, pinned a medal on me,sent me down the hall, said, "You're our boy."

Use acid on your finger tips to remove the prints and use that for ID. The only problem is that you are now linked to hundreds of crimes where no traces of fingerprints were found. But at least they wont be able to identify YOU when they find your actual fingerprints somewhere.

The way that most modern fingerprint scanners work is by using matching algorithms. They scan your fingerprint and translate that into a numeric value and then store that. Not a copy of your fingerprint itself. This numeric value cannot be used to recreate your fingerprint but it can however be used to match the output that only your fingerprint will produce when scanned. To be perfectly candid its far easier to steal your fingerprints by stealing something you own than it is to take them from a fingerprint security/tracking system.

like your finger? Look, if "they" want your fingerprint, they're going to come get it from you. If you're a suspect you will be fingerprinted. This time clock is not connected to a federal black-helicopter database, no matter how exciting that might be.

making a stink about something trivial like this makes legitimate privacy concerns look bad

When I was in High School (loooong before most of you were born) I got a part-time job as "page" at the city library (I put books back on the shelf). In order to get it I had to get a physical, be fingerprinted, and sign a loyalty oath. At least you didn't have to turn and cough.

It is much easier to hand a friend your badge or ID card and have them log you in than it is to hand them your fingerprint and do the same. He's a student working in some office at his school, not at a big company that has security guards checking the picture on his ID or something. This is just a quick, easy and convenient (no more forgetting badges!) to make sure he's clocking in on time.

How are they going to violate his privacy with his fingerprints, other than saying 'oo we have your fingerprints no

If they want to check his presence, logging him in and out, there are other methods to do that. They don't need his fingerprints. It worked perfectly well with badges and/or company ID cards.

How exactly does an ID card verify his presence, rather than simply that someone possessing the card happened to run it through the machine?

And, yes, his fingerprints are all over the doorprint. Together with a gazillion of other fingerprints. And withoug registration that makes him one of the anonymous crowd.

As long as no one goes to the extraordinary effort of pre-emptively wiping the handle clean.

It's easy to ridicule people as paranoid. Instead, however, you should be thinking "why the heck are they requiring my fingerprints".

What I am comparing this to is, for example, using a social security number for identification, which seems to generate a large current of opposition here on slashdot precisely because it such a non-physical, easily reproducible security feature. I want anonymity as much as the

Temp companies are doing this as well. Which to me is a good reason to establish property rights for privacy. In that case, you would be the sole non-transferable owner of your fingerprint scan among other data and have sole discretion over what is done with it. They would upon your consent store one single copy of the scan on the device which if copied or otherwise removed for other uses without your consent would now have legal consequences. The beauty of the concept is that you could also establish s

They'd just make you sign a contract giving them an unlimited license to store, transfer, or sell. Property rights won't do jack shit. If you want to stop it, you make it a criminal offense to transfer that data for any reason and don't allow them to hide behind the corporate veil. Anything trying to use property rights and contracts will fail as miserably as it does everywhere else.

The question is actually why we put up with that shit? I mean, it hasn't been an ultimate requirement 20 years ago (mostly because, well, it was impossible without access to NASA-esque hardware), but suddenly we all need to be fingerprinted, X-Rayed, retina scanned and DNA-probed just to get to our workplace? I mean, I could see if this workplace was some sort of superspecialawesomeultrasecret shady black ops government sponsored (but definitly denied) lab developing the next generation I-win button for int

Was it before you committed to the job ? If it was after - then it is a change to your contract, why do you need to accept it ? Unless it is a change in the law in which case you need to bend over and let yourself be shafted.

Not many posts yet but I already see a LOT of posts pushing the idea of not working for this employer. This is not a solution. If we don't fight it and win, it will be adopted by more and more employers until it snowballs into something too big to fight. If we think this is a bad idea, it needs to be fought now while it's still in its infancy.

I had to submit fingerprints in order to get a job working for the U.S. federal government. I don't even have security clearance (although I did have to go through a background check as I hold a "position of public trust"). If the federal government is allowed to take fingerprints as a condition for employment, I don't see how other organizations could be limited in this regard.

Not many posts yet but I already see a LOT of posts pushing the idea of not working for this employer. This is not a solution. If we don't fight it and win, it will be adopted by more and more employers until it snowballs into something too big to fight. If we think this is a bad idea, it needs to be fought now while it's still in its infancy.

I hope you understand that 'not giving them' a fingerprint for privacy concerns is a relatively moot point.

If someone that employs you or works with you (or even not working with you, but knows of you) wants your fingerprint they can simply grab up any of the many things you touch on a daily basis.

Most people don't wear gloves when they leave the house.

Your fingerprints are all over the place. If I wanted them, I could get them.

...that you stop being such a whiney bitch. So they want your fingerprints to ID you...so what? What is it that you're worried about that they're going to do with them, other than use them internally for authentication purposes?

I am in the process of contacting the local newspaper...

Are you for real? Other than than the fact that they likely won't give a rats ass about this, you are treading on very thin ice. I'm not sure what it is you're planning on doing after graduation, but being labeled a well-known whistle-blower isn't going to do you much justice when you're out looking for a job.

being labeled a well-known whistle-blower isn't going to do you much justice when you're out looking for a job.

We need a +1 coward moderation.

There are plenty of arguments about why this guy shouldn't be concerned about using his finger print to clock in and out, but being worried about being labeled as a honest man who fights for his principles isn't one of them.

We had one, after the first couple of weeks people started punching it instead of "punching in". They're supposed to also have a keypad so you can manually enter an access code, since the reader is known to be undependable.

If you want to mess it up, each time you stick your finger on it while it's "registering you" (it needs more than 1 scan), put your finger in a different position, different angle, or even use a different finger (people generally don't notice). After 5 failed attempts, they'll give up. Or, if they "insist" o "helping you" place your finger, tell them that as far as you're concerned, their broken machine is their problem, and that touching you is common assault and you'll file charges.

We had one, after the first couple of weeks people started punching it instead of "punching in". They're supposed to also have a keypad so you can manually enter an access code, since the reader is known to be undependable.

It was tempting to just hack into the PC it was running on and just update the stupid database manually, but that would have been too much work to maintain, running after everyone and asking them what hours they wanted to show on the timesheet.

...that the next time a pompous administrator says in public "nobody has complained about that," you know that he is lying. Settle for not just knucking under without saying anything at all. Settle for knowing, if you do know, that your complaint has reached someone who sets policy and that you're not just making things hard on a bunch of other ordinary workers whose job is to keep things running.

This is not nothing at all, but it's a small thing.

You can't change the world through indignation. You really have only three choices. First, be docile and do nothing at all. That's often a good option by the way. Second, make sure your concerns have been heard, even if they are dismissed. Or, third, be prepared to devote at least a year or two of your life to the cause of fighting this thing.

If you feel that spending a year or two toward the goal of getting the university to stop using fingerprinting gadgets for access to work-study jobs is worth it, and is what you want to do with that chunk of your life, you can probably achieve your goal. I dunno how. Work through the union if there is one? Start a union if there isn't one? Make appointments and personally talk to one administrator after another, calmly, until you figure out how to get the policy changed? Personally work out an actual proposal, including costs and benefits, for alternative security, so you're presenting them with something positive and their work all done for them, instead of just saying "don't do what you're doing?" Find a faculty committee that's interested in the question that you can swing to your side? I dunno.

I prefer nodding my head, going along, working my way through the system. Then when the day comes that I can and understand it enough to not get caught, I sabotage it. Of course posting here I'll never get to do that in a dramatic fashion but I can inspire anonymous cowards can't I?!;)

I installed these at a client.The issue was the employees would take an afternoon off to go to an appointment, and get buddy to clock them out at the end of the day - The emplyoee would then get paid for an afternoon they didnt work.

The time clocks have a fingerprint scanner. You place your thumb on the device as you punch out. Now buddy cant swipe out for you, and you cant defraud your employeer.

They also had biometric locks instead of prox cards on the doors. Much more convieient then having to remember a card the few days when i was on site.

Your prints are not stored, a geometric design made from identifiable parts of your fingerprint are stored.

Your making a big deal about nothing. Besides as other people have pointed out I can grab your fingerprints from your car door, or from a soda can in your trash. FYI your bank has your fingerprint, and odds are that your parents had your fingerprints taken at some point in your life as you are in college.

The purpose of this device is to keep people from cheating on their hours. You can get all Big Brothery all you like, but there is one and only one technology that can reliably ensure that people come to work and do the jobs they're paid to do.

It's called "management". The way it works is, you know your employees' names, you stop by their workstations, both to help them with problems they're having and to check to see that they're doing their jobs. You build up a culture of trust, so that when they need to leave work they *tell* you, and you arrange for them to make up the time.

Or you can treat them like condemned criminals, and let them be monitored by machines while you sit in your throne of an office eating donuts and browsing bmw.com. It's really up to you.

I know this will surprise many slashdot readers but using your fingerprint as described by the poster for the purpose of clocking you in and out of work would be illegal in many countries accross Europe (with the possible exception of the UK). In France, for example, you can actually get fined by the data protection authority for doing so.

It's true that most of these devices don't store an image of your fingerprint but rather a "template" : a description of some special features of your fingerprint. But that doesn't change the problem.

Indeed, many data proctection authorities accross the EU consider that biometrics pose sevreall security and data protection issues and must therefore be used with caution. Fingerprint biometrics are of special concern, in particular when the biometric data (templates) are stored in a central database. The big problem with fingerprints is that we leave them everywhere, on all objects we touch. Someone can pick up your fingerprint and test it against the templates inside the database. (Sounds crazy or technically impossible ? It's much easier than you think : i've tested it myself, that's part of my job). There are other issues whith fingerprint biometrics that I won't detail here.

In the end data protection authorities in the EU consider that the use of a central fingerprint database is excessive if your only objective is only clocking people in and out. Instead, they encourage the use of a smartcard to store the biometric data : you show your finger to the biometric reader and it gets compared with the data stored in the smartcard. This solution offers the same benefits in terms of security but you keep control of your biometric data.

Privacy doesn't seem to be the real issue here, unless they're selling your prints to the Feds. What I would like to know is: given the fact that these things don't work worth a damn, why would they be using a system like this in the first place?

I mean, if I had to use a fingerprint scanner for identification, I'm the kind of person who would fool with it just for fun. The only way they have been able to make them "reliable" -- that is, reliably accept your fingerprint and not lock you out -- was to loosen up the match criteria enough that they are much too prone to false positives, which in turn makes them easy to fool.

I would do things like clock in Susan for four hours when she is really on vacation in Hawaii, for example, just to see what happens. Or clock in Sam at 3 a.m. so that when he comes around at noon and scans, he's really clocking out. And so on. Consider it like friendly hacking... you are showing the owners that their system just doesn't work. It's a useful technique when they simply won't listen to reason.

Sheesh... this is the same as having public and private encryption keys. The private one is for you, the public one is... you guessed it, public, and cannot be used to reproduce or fake the private one. They only store enough data to verify your fingerprint again. VERIFICATION and IDENTIFICATION are two very different things. No privacy issue.

These devices only store a few numbers that were derived from the patterns of your prints. They don't store anything near the actual image. When you re-scan your finger to clock in it creates a new set of numbers and looks for a set that is statistically close to something it has in it's database. Usually you have to enter a PIN as well because these things do such a crappy job that without knowing where to start, it would have a terrible time figuring out which of the stored sets of numbers match up to the one you just scanned in. I'm not saying that some systems can't do a great job. I'm just saying that the kinds of systems they sell for time-clocks are usually pretty lame. Especially after they get beat around for a while. So all these time-clock units really do is determine if the clock-in scan is statistically close enough to the original scan to be more likely to be you than some other employee. The actual data stored is less personally identifiable than your name. Are you gonna complain if they ask you to give your name when you clock in?

I also seriously doubt that these things produce any form of standardized data that could be transferred to any other system. Heck, sometimes the scans won't match up just because you bought a slightly different model from the same manufacturer to replace a broken unit. Ever try to troubleshoot one of these systems? It is a nightmare.

So, you have nothing to worry about. "They" are more likely to track you by mere facial recognition via security cameras than by your fingerprints.

They are NOT finger printing him. They are having him clock on with a biometric finger print scan. There are certainly concerns with this sort of thing, but it's not the same.

Certainly there are issues with biometric scanning in regards to the quality of the scanners and what you do if your biometrics get compromised(which is possible), but biometric scanning is not the same as being fingerprinted. They'll only ever take one finger, and generally speaking the resulting hash pr

Oh, holy shit! I'm as much concerned about privacy as any other next guy and then probably more, but this is crystal clear:1) Do you think there's a need for authorization (you can go in, you can't go in)?2) If yes, then you need authentication. As in you *need* authentication or else no one will be sure the authorized guy is the one meant to be authorized.3) If you need authentication, then biometrics is quite a good candidate (while not absolutly great: once it gets tampered ther